Why you've never been in a plane crash

With the number of data breaches we see cropping up, I wonder if a similar law could be written to hold companies liable for the safe handling of personal data.

By this logic, the recent Boeing 737 incident should be considered a gift from the heavens. Which I think is actually a good way to look at it, though we don’t yet know whether this gift will be squandered.

I've been obsessed with the US Chemical Safety Board videos on YouTube that describe in great detail the events that lead up to industrial accidents. One of the common themes I've seen among them is that there's usually some sort of warning sign or near miss that goes ignored by the people responsible for them since they don't cause any major damage. Then a few days or months later that system fails in an entirely predictable way with catastrophic consequences. A good example of this is the fatal phosgene gas release at a DuPont chemical plant[1].

[1]: https://www.youtube.com/watch?v=ISNGimMXL7M

One of the most important pieces of legislation in the UK that helped improve safety in workplaces was the Health and Safety at Work Act 1974, which placed a duty of care on organisations to look after the wellbeing of their staff.

I've not been following closely, but I suspect the Post Office did not follow this. Are there ramifications happening along these lines for the Post Office fiasco? Or is it already a big enough thing that this would just be "oh, and also that too I guess" kind of thing?

(This is a harmonized EU legislation)

YEs. Almost everyone has seen at factories the prominently posted signs updated daily: "XX Days Since a Time Lost Accident". Some years ago, I noticed in some more technically advanced shops a change: "XX Days Since a Near Miss", along with an invitation and method to report near-misses.

Seems like progress; a near-miss noticed is indeed a real gift, if followed-up.

Indeed.

- An accident is a combination of the system being in a hazardous state and unfavourable environmental conditions that turn the hazard into an accident.

- A near miss is when the system was in the hazardous state but the environmental conditions were in our favour so the accident didn't happen.

We can't control environmental conditions, we can just make sure to keep the system out of the hazardous state. This means a near miss contains all we need to perform a proper post mortem. The environmental conditions are really immaterial.

One interesting read on the topic of near misses and High-Reliability Organizations is the paper "Going Solid", which has a great summary here:

https://cohost.org/mononcqc/post/888958-paper-going-solid

Near misses are absolutely like gifts from the heavens. I was part of a post-investigation for a near miss that would've looked like this if things had gone a bit differently:

https://en.wikipedia.org/wiki/NOAA-19#Damage_during_manufact...

Very true.

In general, I think that piece has a bit of a European blind side when starting by “The United States leads the world in airline safety.”

Eh, that’s a really strange way to phrase it. Singling out the engineer isn’t blameless. Sure it’s a learning opportunity but it’s a learning opportunity for everyone involved. One person shouldn’t be able to take the site down. I have always thought of those situations as “failing together.”

I don’t know when this was turned into a Facebook trope, but I’ve heard it before as an engineer asking “Am I being fired?”, to which the director responds “We just invested four million dollars in your education. You are now one of our most valuable employees!”

Whenever this happens to someone it's always a horrible feeling where one feels very guilty and ashamed no matter what people say to you and unfortunately mistakes like these are almost the bread and butter of any extremely experienced grey beard so it's kind of normal that something like this happens to someone at some point sooner or later. The only people who never make costly mistakes are those who were never trusted with responsibility in the first place.

So having said that I would like to emphasise that the cost which often gets quoted with those mistakes is not a real cost, it's an unrealised opportunity cost and sure it hurts, but you know what, the same company culture that allows such mistakes to happen and miss out on opportunity costs is the same culture which also allows engineers to quickly roll out important features and updates and therefore create more opportunity in the first place, and much faster as a whole, so in theory the cost doesn't come without the opportunity and it all evens itself out. Don't feel too bad about it.

Someone get Zuck an above-average-manager award.

But that isn't quite what you want in a blameless culture. The right response looks something like ignoring the engineer, gathering the tech leads and having an extremely detailed walkthrough of exactly what went wrong, how they managed to put an engineer in a position where an expensive outage happened and then they explain why it is never going to happen again. And anyone talks about disciplining the responsible engineer shout at them.

Also maybe check a month later and if anything bad happened to the engineer responsible as a result of the outage, probably sack their manager. That manager is a threat to the corporate culture.

Maybe Zuck did all that too of course. What do I know. But the story emphasises inaction and inaction after a crisis is bad.

Look to your left, look to your right, count the heads. Now divide the money that was lost through the number of heads. This is the theoretical ceeling- how much you could make if there were no shareholders and you had your own company - or had a union.

Just so you are aware, it would probably take a lifetime or more to recoup the revenue lost during that outage. But we don’t assign blame

Assuming that’s accurate, it’s a pretty shitty way to put it. “Hey man, just so you know you should owe me for life (and I pay your salary so I decide that), but instead of demanding your unending servitude, I’m going to be a chill dude and let it slide. I’m still going to point it out so you feel worse than you already do and think about it every time you see me or make even the smallest mistake, though. Take care, see you around”.

It’s the kind of response someone would give after reading the Bob Hoover fuelling incident¹ or the similar Thomas Watson quote² and trying to be as magnanimous in their forgiveness while making it a priority that everyone knows how nice they were (thus completely undermining the gesture).

But it’s just as likely (if not more so) the Zuckerberg event never happened and it’s just someone bungling the Thomas Watson story.

¹ https://www.squawkpoint.com/2014/01/criticism/

² https://blog.4psa.com/quote-day-thomas-john-watson-sr-ibm/

First of all, the "expensive training now you'll be the guy we trust the most blabla" story has been around for decades.

Second, if this one is true it's a terrible way to phrase/present it.

When I was only a few years into my career I accidentally deleted all the Cisco phones in the municipality where I was a sowtware developer. I did it following the instructions of the IT operations guy in charge of them, but it was still my fault. My reaction was to go directly to the IT (who wasn’t my) boss and tell him about it.

He told me he wasn’t happy about the clean up they now needed to do, but that he was very happy about my way of handling the situation. He told me that everyone makes mistakes, but as long as you’re capable of owning them as quickly as possible, then you’re the best type of employee because then we can get to fix what is wrong fast, and nobody has to investigate. He also told me that he expected me to learn from it. Then he sent me on my way. A few hours later they had restored the most vital phone lines, but it took a week to get it all back up.

It was a good response, and it’s stuck with me since. It was also something I made sure to bring into my own management style for the period I was into that.

So I think it’s perfectly natural to react this way. It’s also why CEOs who fuck up have an easy time finding new jobs, despite a lot of people wondering why that is. It’s because mistakes are learning experiences.

> it would probably take a lifetime or more to recoup the revenue lost during that outage.

Must be hard times at Facebook if a short period of downtime in 2010 still hasn't been recouped.

let’s just consider it an expensive learning opportunity to redesign the system so it can’t happen again.

Also, Zuck: but hey everyone, keep on moving fast and breaking things!

Trust Zuck to get it wrong...

r/fuckcars has members who deflate and slash car tires that belong to vehicles they deem "too big". Do you support that methodology?

The cognitive dissonance people have around this issue is astonishing. We are willing to ground the 737MAX fleet when a few people get a (surely terrifying) open air flying experience; but 44,000 people are killed on the road in the US _every_ year (and rising!) and very few people seem to care. In most age cohorts, death by car is the largest killer. In the US you have a 1 in 107 chance of dying in a car crash in your lifetime. Even simple and completely reasonable measures to reduce these insane numbers are seen as some kind of tyrannical affront to ones freedom (see the current CA measure to add speed limiters).

The car industry, car culture, and car centric thinking in the US and much of the world is totally out of control.

https://en.m.wikipedia.org/wiki/Motor_vehicle_fatality_rate_...

TIL that car fatalities were declining until 2019, and then reversed and are getting worse.

What happened in the last five years? Safety features of the cars themselves are improving (emergency braking). Alcohol may be a factor, but why in the last five years? Cars have been big for a while. WFH probably reduced commuting time. Other countries appear to be on the decline.

Unpopular opinion, but the truth: We have to drive and it's a right. I agree about the infrastructure issues. Still the modern "safe driving" mentality that people want is at odds with that REALITY.

This could change with public transit, however we don't do this. Even the best countries fall short, and most don't get close. It's actively discouraged in the USA.

Actually, you could argue that people already have to deal with too much BS to drive. The paperwork, rules, and so forth clearly are challenging for people to adhere to. So we throw the majority of people into a situation they aren't equipped for on a daily basis. Then this becomes a major cause of legal efforts, that alienate perfectly good citizens from society and cause us to forfeit our civil rights.

You can claim that people just need to be responsible, or we need to pass some safety law but it's delusional. The truth is we don't have a replacement for this. The average person can't afford to be carted around, and we would need to get to a place where driving was purely recreation.

So we are going to need very good public mass transit options, and IMO some kind of vast network of professional drivers that are more affordable than Uber, for the occasional "cargo trips" or to go "the last mile" (more like 10-50).

There are a lot of factors that really complicate this system.

Enforcement focuses on the wrong parameters. Police love to remind us that, "Speed is always a factor." Well, it's certainly the most easily measured one. The trouble is, what speed is wrong? Is it the 5 cars who want to drive 90mph on the freeway, or the 2 cars who want to drive 65 in both lanes? By obsessively enforcing speed limits, police have managed to perversely incentivize the difference in speed between drivers who are willing to risk a ticket, and drivers who self-righteously bottleneck traffic. I have never even heard of the law, "keep right except to pass" being enforced, even though it seems pretty obvious that it would help.

People don't want to drive. People have to drive. That reality perversely incentivizes drivers to minimize effort. There is very little motivating drivers to drive better than they need to. How could we possibly change this incentive? Fear tactics are not working. Threats are not working. This is an open question: what if it has no answer?

Infrastructure demands backwards-compatibility. We can't just build a new part of a city without roads. Where would people put their cars? If people living there didn't have cars, then where could they go? Where could they work? Could anyone visit? Utopia must have a compatibility layer: somewhere that alternative transit can transition to highways. But where? If you have to park your car away from home, then you need to manage the risk of unattended property. If you have to get a ride in someone else's car, is that affordable? If you are going to take a bus, how long will you have to wait? How many busses will you have to transfer between? No matter what we do, the compatibility layer will always be inefficient.

Infrastructure demands infrastructure. The only solution to more traffic is more road. The only solution to more road is longer driving distance. The only solution to longer driving distance is more time in traffic, which is identical to more traffic. The only way to stop growing this system is to stop growing the amount of drivers. How can that be done? In order to become a non-driver, you need a minimum viable alternative, otherwise you will have to drive just like everyone else. In order for alternative transit to be viable, there needs to be enough of it around that it feeds its own infrastructure demand. If alternative transit is built with a highway-compatibility layer, then that compatibility will effectively remove the need for alternative-transit growth. Realistically, alternative transit won't start demanding itself until its utility is equal to the highway system. We can't build that all at once, so how can we overcome the already-present highway infrastructure demand cycle?

No matter how you look at it, the highway system is feeding the worst aspects of itself into its own growth. The only way to change this cycle is to build a lot of alternatives really fast, and make them dirt cheap. It's a political nightmare. Even so, I would much rather live in that nightmare than the one where rubber meets the road.

<whiney rant> After notjustbikes got big, he dropped any humility and started preaching to the choir, calling people who didn't agree with him racist idiots. I complained in the comments that I used to be able to recommend his videos sight-unseen to the people who needed to be convinced. He replied and insulted me as someone who just found his channel and couldn't take the truth. </whiney rant>

Cars? Hahaha. I feel like the difference is:

Planes: sometimes pilot error, often mechanical/maintenance. Almost never because the pilot is flying like a wanker.

Cars: sometimes driver error/inexperience, sometimes mechanical/maintenance, almost always because the driver is driving like a wanker.

The ability to drop blame from the equation is a credit to the aviation industry and would drastically improve any team, organisation, or industry to adopt it.

This system does in fact work very well for aviation in the USA. But I think we can't just blindly apply it to everything everywhere, assuming it will work the same. We should be able to consider what cultural factors allow it to work and what might cause it to fail. Among those reasons:

* It expects everybody in the organization to be earnest rule-followers doing the best they can to achieve the goals of their organization. The uncaring, reckless, rebellious, etc people have been screened out of the organization long before it gets to that point.

* It expects that the whole organization has cultural unity. Nobody is trying to hoard status, power, influence, etc for one subset of the organization at the expense of another.

* It expects that the organization as a whole is not, and does not perceive itself to be, under attack from hostile outside forces. Organizations can effectively fear being blamed and destroyed just as well as individuals can.

It's basically the essence of aviation safety work.

If one concentrates on blaming individuals, the system is not fixed.

And if you like this sort of thing, you might also enjoy the various people that do reconstructions on YouTube - the real audio played over animations/flight sim of what the planes are doing. The most interesting/lively ones are those with a 'possible pilot deviation' or 'number to call' IMO if you want a search term to narrow them down.

I'm not a pilot or planespotter or particularly interested in planes generally, I've just fallen down that rabbit hole a couple of times for some reason, can be quite interesting. It has made me wish the in-flight entertainment included a 'listen to pilot/tower comms' option.

The USAir 1493 crash happened in 1991, a decade after the PATCO controllers were fired. I have a hard time believing that there is any connection - by 1986 or 87 the controller position has already been fully properly staffed with trained controllers. Throwing the mention of PATCO in a discussion of a 1991 incident would just further a political agenda and add nothing to the discussion.

This is however not her usual writing style as used for the blog.

Thank you for pointing that out! I’m a big fan of Admiral Cloudberg, and was in fact even thinking of her while reading this article, but I did not make the connection. She’s such a fantastic writer.

Does anyone know how she became so good at writing about airline disasters? She doesn’t seem to have any sort of aviation background.

I had the same thought. You, reader, have never been in a plane crash, because if you’d have been in one, you’d be dead.

We don't count those that are eaten after the crash as they survived the impact and immediate aftermath.

More seriously:

    But for those unlucky enough to be involved in the small percent of fatal air accidents, what are the odds of survival if your plane does crash?

    The NTSB says that despite more people flying than ever, the accident rate for commercial flights has remained the same for the last two decades, and the survivability rate is a high 95.7 percent.

    The European Transport Safety Council (ETSC) has also examined the survivability of aircraft accidents worldwide, estimating that 90 percent are survivable (no passengers died) or “technically survivable," where at least one occupant survives.

    Most of those fatalities were a result of impact and fire-related factors including smoke inhalation after impact.

I was about to say more or less the same thing, then I saw your post.

Whoever got curious enough to enter this comment section: carve out some time to read the CAST handbook. It changed how I look at accidents but also how I look at organisations and the rest of the world. Should be mandatory reading for anyone in any position of responsibility.

I have long wanted to write a review/summary of it on my blog but it's so dense in useful content it's hard to compress further. (There's a reason I have not published it so please try not to judge it for its rough edges, but this is what the draft looked like when I gave up last time: https://two-wrongs.com/root-cause-analysis-youre-doing-it-wr...)

In fact about 90 % of plane crashes are survivable and people read about their own accidenyäts.

I don't know... I once met a guy who had survived two of them:

https://news.ycombinator.com/item?id=7370320

2/3 of people in plane crashes survive

Yeah, probably, and the counterfactual where airlines were worse at preventing crashes would probably have worse crash survival rates as well. Maybe planes bumping into each other at very low speeds on the ground would skew the stats in that case, but you know what I mean by "plane crash".

Also nitpicking about the headline: You haven't been in a place crash because you wouldn't be reading this if you were :)

Do you mean to imply that being in a plane crash is certain to result in death? Because that's definitely not true. Even when they crash hard enough to explode, there are sometimes still survivors.

You haven't been in a place crash because you wouldn't be reading this if you were :)

We have a kick-ass politician in switzerland who survived a avalanche (1993) and a Plane-crash [1] (2001)

[1]https://en.wikipedia.org/wiki/Crossair_Flight_3597

https://en.wikipedia.org/wiki/Jacqueline_Badran

Otherwise events like the MCAS disaster would be just an "happy accident" with no one to blame.

But it was. Boeing being allowed to self-certify their own aircraft was ultimately what allowed it to happen.

The thing with the two MCAS accidents is that you don't have too few people to blame, but too many:

- the airlines who wanted a more fuel-efficient plane that should still have the same type certificate as the (at that time) 40+ year old Boeing 737

- Boeing management, who wanted to keep those airlines as customers

- Boeing engineering, who did what they did at the management's request

- the FAA, who failed to spot the issue

- the mechanics of the involved airlines, who dispatched the planes without working angle-of-attack sensors

- the airlines who ordered planes without the (optional) "angle-of-attack disagree" alert

- the pilots (just for the sake of completeness), who failed to notice the issue and either refuse to fly the plane or correct it in time to avoid the crash

Who do you want to single out here?

Otherwise events like the MCAS disaster would be just an "happy accident" with no one to blame.

...it's the same aviation industry with the same approach to investigations outlined in the article that did, in fact, expose everything that you know about the 737 MAX's MCAS issues and led to their ultimate mitigation.

"Blameless", in this instance, is referring more to individual people, not absolving organizations and processes of responsibility (assuming no negligence). The ideal it's trying for is to approach an accident not as a wrong to be avenged with punishment but a technical failure to be understood, allowing changes to be made to prevent it from reoccurring.

No, accountability is a very insufficient answer, because it helps very little in identifying and fixing broken systems.

In a lot of cases, this one being a particularly good example, nobody was particularly incompetent, negligent, malicious, or greedy. But the system as a whole lacked safeguards so that a single person's inconspicous mistake could cause a disaster, and overloaded that person's attention.

Sure, there's other cases where you can clearly identify negligence, malice, or greed of specific people as causes of the disaster. But there as well, holding those people accountable doesn't fix the system than incentivised the greed, doesn't prevent incompetent, malicious or negligent people from getting into positions where actions based on those traits cause disasters, and doesn't provide safeguards against such actions.

The deterrence value of holding individuals accountable for extremely rare events is approximately zero.

I don’t think that’s what’s implied here at all - the focus on blamelessness is to get to the root cause of failure and prevent future occurrences rather than to punish existing failures without affecting any actual change.

Strong Towns is attempting to change that with the "Crash Analysis Studio": https://www.strongtowns.org/crash-studio

I can think of many reasons it's difficult, though:

* The fact that accident investigations are designed to figure out which driver was at fault, for insurance purposes

* The fact that road designers are shielded from liability (good, right?), but only if they can show they followed the standard design handbooks, which not only fail to prioritize safety over traffic flow but also don't require or even contemplate performing a thorough case-by-case investigation into how to prevent a certain type of accident from happening again. (Crash Analysis Studio tries to demonstrate how to do this.)

* The sheer scale of the changes to roads that would be needed. In the States, access of hundreds of thousands of businesses and probably millions of homes depend on roads that are supposed to get people from A to B fast but also have lots of access points for businesses on them, which is like just like mixing taxiing and holding with takeoff and landing, but without the air traffic controllers. And don't get me started about unprotected lefts across multiple lanes of traffic.

* The lack of buy-in from the citizenry for enforcing professional-like standards on drivers. Despite the blameless culture that helps identify flaws in the system, air traffic controllers, pilots, maintenance crews, train engineers, etc also know that their job depends on making a sincere effort to follow the rules that are written, and in most cases their professional identity is tied up with following the rules. (I've heard that to be a pilot you really have to be comfortable with doing what you're told, all day long.) There's really no obvious way to get the masses of drivers to think and feel that way about their driving, and of course we can't just sanction our way to compliance because people need their licenses to go about their lives. And of course usually there is no reasonably alternative to driving yourself where you need to go.

Well we do. That's why automobiles have seatbelts and airbags, rear-view cameras, antilock brakes, traction control, and have to pass crash safety tests.

Boeing fucking up with the 737 Max so much is merely a symptom.

They so desperately needed it to remain a 737 so it wouldn’t be a new type and therefore wouldn’t need a new type rating was mostly because the airlines demanded a better 737.

Yes, Boeing is at fault for the MCAS disaster (no redundancies, holy fucking hell), but in reality it was the entire industry.

My point is, had nothing changed, it would have happened anyway, and perhaps with Airbus and not Boeing.

The one big oopsie is “we want a better plane and we also don’t want to retrain our pilots”, which is an oopsie that absolutely was not Boeing’s fault.

Any source would be appreciated, I'd like to read more about it.

It happened to me and my team like 10 years ago or so: An engineer deleted the production database. We were able to recover it. But the postmortem basically focused on why the he heck did we let that happen. The guy stayed in the company for 8 years more IIRC. We fixed our systemic issue as well.

I've read about blameless postmortems from Medical professionals and I always tell my teams: if those guys (doctors) can do blameless PMs after someone has died, we can do them.

Also reminds me of the Reddit thread [0] where someone accidentally used write access credentials that were on an onboarding document and wiped the production database. GitLab guy actually joined the conversation.

[0]: https://www.reddit.com/6ez8ag/

Sorry for your loss. I hope something was learned by others so it will not happen again.

It sounds like you didn't read the post. It's not an assumption, it's the explanation of why.

It's interesting how people carry their preconceived notions into articles like this, especially when those articles are about entirely different industries and/or contexts than they're used to.

For example, reading any NTSB report would make it quite clear that the actions of specific individuals - from pilots to controllers to maintenance techs and more - are very much mentioned and dissected under the "blameless" style of investigation that international aviation adheres to. But people already have their own ideas of what "blameless" means that inevitably colours their reading - in some cases, colours it so strongly that not even the evidence of success is enough to budge the conclusion that there must be something wrong with the way "blameless" culture is implemented.

The issue with attributing failure, no matter how little suffering there is, is that it provides a huge incentive to not self report and/or downplay incidents.

Unless you are acting with malice, your actions are a product of the system and procedures in place. Those should be the focus of improvement, not individuals. E.g. preventing prod pushes that contain unreviewed code.

Of course we need to talk about individuals, but that's performance management and not incident management.

Title is iffy. Tantamount to writing "Why you have never died."

Anthropic principle or observation selection effect [0]. If you are observing something, then you are in a position that you can observe it.

[0] : https://en.wikipedia.org/wiki/Anthropic_principle

This is where I stopped reading the story. I couldn't tell that we were getting to the point of answering the titled question. I'm guessing it's the blameless culture/process that keeps information flowing and improvements made.

'Blameless' doesn't work for corporations though.

Yes I think it even flows better to know that and then focus on discovering why.

Wow, I remember this! Glad you were a-ok. Would love to hear more about your story and your method of egress from that bird.

For those that don't know, LAS to BUR is the best way to get from LA to Vegas (save private) and always has been.

I've been on that Sunday afternoon flight from LAS->BUR many times; with the afternoon flight informally known as the Hangover Express and the morning flight known as the Stripper Express. Good times.

And FWIW, I still prefer FORTRAN over Perl any day...

In a team of individuals, the term isn't necessarily "blameless". I'd never hold a weird or accidental outage against you personally. The major question would be: Why did that happen?

However, you're forever going to be the fucking guy causing a database outage on Christmas. You might have had no choice, but fuck you.

All of us have these scars.

But then the question is: Why do we all have these scars? Maybe the system we're dealing with is not as great as it should be? Maybe the localized amount of anger is just a thing leading towards a more systematic problem. Oops, back into the ideas of blameless post-mortems.

Rickover is an intriguing figure to read about in general. I've heard different versions of his "rules", one set located here:

https://www.linkedin.com/posts/kelly-robinson-phd-92842b6_ri...

Another I'll include at the bottom of this post.

I also just wanted to highlight two things. Not only did he create a highly safety conscious organization but an incredibly technologically innovative one that was born despite huge resistance from the US Navy. Think about trying not only to build a small nuclear reactor, something that had never been done before, but one that could be put on a submarine. Not an easy technical goal. And on top of that, aiming to complete this task in the face of resistance from the highest levels of the organization he made his life, including efforts to get rid of him entirely. He wasn't perfect but what he achieved quite alot. Definitely worth reading more up on particularly if you work more in the mechanical engineering world.

Second set of Rickover Rules:

Rule 1: You must have a rising standard of quality over time, and well beyond what is required by any minimum standard.

Rule 2: People running complex systems should be highly capable.

Rule 3: Supervisors have to face bad news when it comes and take problems to a level high enough to fix those problems.

Rule 4: You must have a healthy respect for the dangers and risks of your particular job.

Rule 5: Training must be constant and rigorous.

Rule 6: All the functions of repair, quality control, and technical support must fit together.

Rule 7: The organization and members thereof must have the ability and willingness to learn from mistakes of the past.

No, I don’t think reading this (now) has prevented you being in a plane crash (in the past.)

I can also recommend Green Dot Aviation and Mentour Pilot